5 ms·

This is quite a simplification. There are a lot of useless/dubious controls out there, but the problem is rather the contradiction between security pragmatism a

This is quite a simplification. There are a lot of useless/dubious controls out there, but the problem is rather the contradiction between security pragmatism and compliance regimes. #### Government: I need a service. Contractor: I can provide that. Government: Does it comply with NIST 123.456? Contractor: Well not completely, because control XYZ is ackshually useless and doesn't contribute-- Government: hangs up

deathanatos 2y ago
I think it's fine to implement a useless control to get a customer. Just don't pretend that you're doing it because it is a useful control, pretend that you're doing it because jumping through that hoop gets you that customer, and "we're a smaller fish than the government". Especially with the government (especially if it's the USA…) there are going to be utterly pointless hoops. I can pragmatically smile & jump, … but that doesn't make it useful.
- JoshTriplett 2y ago
  Exactly. There is absolutely a threshold of money that will get me to implement FIPS. There is no threshold of money that will get me to say it's a good idea that has any value other than getting the (singular) customer that demands FIPS.
  - SAI_Peregrinus 2y ago
    The core idea of FIPS doesn't seem terrible at first glance: a validation program to ensure known attacks are protected against. The obvious issue is that known attacks have progressed significantly faster than FIPS has been updated, so in practice it doesn't defend against actual attackers. Compliance-based security pretty much always falls into this trap, and often is even worse because compliance with the standard is considered the maximum that can be done instead of the minimum that must be done. FIPS' fatal flaw is that in many cases it mandates a maximum security level that is now outdated. It's a lot like building or electrical codes: if they're treated as the minimum as intended things stay safe, but if they're just barely complied with then buildings tend to fall down and/or catch fire.
- encomiast 2y ago
  I guess as a company I would agree that it's fine to implement a useless control to get a customer. As a tax-payer...not so much. We spend so much money (at least in the U.S.) on garbage.
count 2y ago
"We have an alternate implementation / mitigation" gets you passed the hangup, for folks who need the magic words for 'thats dumb. we do it right'.
not2b 2y ago
Note, though, that "the government" (NIST to be specific) says that requiring passwords to be changed every 90 days is counterproductive and shouldn't be done, yet many corporations (including my employer) still mandate it. Corporate bureaucracy can be as backward and counterproductive as government bureaucracy.

deathanatos 2y ago

I think it's fine to implement a useless control to get a customer. Just don't pretend that you're doing it because it is a useful control, pretend that you're doing it because jumping through that hoop gets you that customer, and "we're a smaller fish than the government". Especially with the government (especially if it's the USA…) there are going to be utterly pointless hoops. I can pragmatically smile & jump, … but that doesn't make it useful.

JoshTriplett 2y ago
Exactly. There is absolutely a threshold of money that will get me to implement FIPS. There is no threshold of money that will get me to say it's a good idea that has any value other than getting the (singular) customer that demands FIPS.
- SAI_Peregrinus 2y ago
  The core idea of FIPS doesn't seem terrible at first glance: a validation program to ensure known attacks are protected against. The obvious issue is that known attacks have progressed significantly faster than FIPS has been updated, so in practice it doesn't defend against actual attackers. Compliance-based security pretty much always falls into this trap, and often is even worse because compliance with the standard is considered the maximum that can be done instead of the minimum that must be done. FIPS' fatal flaw is that in many cases it mandates a maximum security level that is now outdated. It's a lot like building or electrical codes: if they're treated as the minimum as intended things stay safe, but if they're just barely complied with then buildings tend to fall down and/or catch fire.
encomiast 2y ago
I guess as a company I would agree that it's fine to implement a useless control to get a customer. As a tax-payer...not so much. We spend so much money (at least in the U.S.) on garbage.

count 2y ago

"We have an alternate implementation / mitigation" gets you passed the hangup, for folks who need the magic words for 'thats dumb. we do it right'.

not2b 2y ago

Note, though, that "the government" (NIST to be specific) says that requiring passwords to be changed every 90 days is counterproductive and shouldn't be done, yet many corporations (including my employer) still mandate it. Corporate bureaucracy can be as backward and counterproductive as government bureaucracy.